Hi, I have plan to install Splunk Enterprise SIEM in the cyber security operation center, and universal forwarder will be installed on each workstation in order to transmit windows event log. From what I studied at the splunk site, it seems that I can design Architecture 1 or 2 as shown in the picture below.   I would like to know the pros and cons of using a heavy forwarder because I need to purchase an additional server to install Heavy Forwarder. Also, I want to get technical support for purchase from korea engineer. Could you please give me email address for technical support? I could not find email address about korea engineer in splunk website.    Best regards, ... View more

Hi, I always appreciate your taking the time to answer my question. We will connect independent systems using the L3 Switch and send the syslog to the cyber security operation center (CSOC) like attached picture. (Network switch will send via syslog function, and Splunk forwarder will be installed on workstation)   Since the application that was installed in the workstation cannot be modified, the IP address of server cannot be changed. For example, if there is an application that communicates with a server having address of 192.168.0.10, it is impossible to change the server IP address because the application code cannot be modified.   Splunk Enterprise SIEM will be installed in CSOC, and Heavy Forwarder will be used as the agent for syslog transmission. If IP addresses are duplicated between independent systems, is there a problem in transmitting logs? Also, is there a function to transfer syslog by changing the source IP address to distinguish assets? Or is there another way to differentiate between assets?   Best regards,   ... View more

  Hi, I always appreciate your taking the time to answer my question. We will connect independent systems using the L3 Switch and send the syslog to the cyber security operation center like attached picture. (Network switch will send via syslog function, and Splunk forwarder will be installed on workstation)   Even if the IP address is duplicated in each system, the IP address cannot be changed. If IP addresses are duplicated between independent systems, is there a problem in transmitting logs? Then, what is the solution to this problem?   Best regards, ... View more

Hi! I'm searching for an appropriate agent to transmit Windows Event log to syslog server.   Can Universal Forwarder convert Windows Event logs to syslog for transmitting log?     Best regards,   ... View more

Hello, The following process variable logs are created in my system. Time | Target | Variable | Status 00:00:00 1 99 On-line 00:00:01 2 89 On-line ...... 01:01:03 10 76 Off-line I want to send all process variable logs to Splunk's SIEM by using Universal Forwarder. However, I don't know how to set-up its configuration to send log file. Could you please tell me how I can set-up it? Thanks, Kevin ... View more

Hello, I want to transmit all logs to Splunk's SIEM. Therefore, there are some questions. Q1. In our network system, Splunk's Forwarder will be used as an agent for log transmission. I'm wondering what kind of log can be sent to SIEM for each forwarder (Universal, Light and Heavy). Q2. The Windows event logs as well as process variable logs are stored on our workstation. - Process variable logs Time | Variable | Status 00:00:00 99 On-line 00:00:01 89 On-line ...... 01:01:03 76 Off-line Can these logs be analyzed in Splunk's SIEM? If possible, can it be sent to SIEM through Splunk's forwarder? Thanks, ... View more